Update all minor versions (master) (minor) #22
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
renovate
bot
force-pushed
the
renovate/master-all-minor-versions
branch
2 times, most recently
from
7af390c to
3753e10
Compare
renovate
bot
force-pushed
the
renovate/master-all-minor-versions
branch
from
3753e10 to
5e58b6a
Compare
renovate
bot
force-pushed
the
renovate/master-all-minor-versions
branch
from
5e58b6a to
1341ce9
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==4.7.1->==4.9.41.21.4.3-2-jammy->1.27.1.1-2-jammy==2022.1.8->==2022.12.19==2.27.1->==2.32.3Release Notes
lxml/lxml (lxml)
v4.9.4Compare Source
==================
Bugs fixed
LP#2046398: Inserting/replacing an ancestor into a node's children could loop indefinitely.
LP#1980767, GH#379:
TreeBuilder.close()could fail with aTypeErrorafterparsing incorrect input. Original patch by Enrico Minack.
LP#1522052: A file-system specific test is now optional and should no longer fail
on systems that don't support it.
Other changes
Wheels include zlib 1.3, libxml2 2.10.3 and libxslt 1.1.39
(zlib 1.2.12, libxml2 2.10.3 and libxslt 1.1.37 on Windows).
Built with Cython 0.29.37.
v4.9.3Compare Source
==================
Bugs fixed
LP#2008911:
lxml.objectifyaccepted non-decimal numbers like²²²as integers.A memory leak in
lxml.html.cleanwas resolved by switching to Cython 0.29.34+.GH#348: URL checking in the HTML cleaner was improved.
Patch by Tim McCormack.
GH#371, GH#373: Some regex strings were changed to raw strings to fix Python warnings.
Patches by Jakub Wilk and Anthony Sottile.
Other changes
Wheels include zlib 1.2.13, libxml2 2.10.3 and libxslt 1.1.38
(zlib 1.2.12, libxml2 2.10.3 and libxslt 1.1.37 on Windows).
Built with Cython 0.29.36 to adapt to changes in Python 3.12.
v4.9.2Compare Source
==================
Bugs fixed
from a failed parser run leak into later parser runs. This bug was worked around
in lxml and resolved in libxml2 2.10.0.
https://gitlab.gnome.org/GNOME/libxml2/-/issues/378
Other changes
LP#1981760:
Element.attribnow registers ascollections.abc.MutableMapping.lxml now has a static build setup for macOS on ARM64 machines (not used for building wheels).
Patch by Quentin Leffray.
v4.9.1Compare Source
==================
Bugs fixed
iterwalk()(orcanonicalize())after parsing certain incorrect input. Note that
iterwalk()can crashon valid input parsed with the same parser after failing to parse the
incorrect input.
v4.9.0Compare Source
==================
Bugs fixed
lxml.htmlwas corrected.Patch by xmo-odoo.
Other changes
Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12.
Wheels include zlib 1.2.12, libxml2 2.9.14 and libxslt 1.1.35
(libxml2 2.9.12+ and libxslt 1.1.34 on Windows).
GH#343: Windows-AArch64 build support in Visual Studio.
Patch by Steve Dower.
v4.8.0Compare Source
==================
Features added
GH#337: Path-like objects are now supported throughout the API instead of just strings.
Patch by Henning Janssen.
The
ElementMakernow supportsQNamevalues as tags, which always overridethe default namespace of the factory.
Bugs fixed
lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively.
Patch by Tobias Deiminger.
Other changes
pypa/pipenv (pipenv)
v2022.12.19Compare Source
Bug Fixes
requirementslibhanging during install of remote wheels files. #5546v2022.12.17Compare Source
Bug Fixes
--creator=venvby default; introduced two environment variables:PIPENV_VIRTUALENV_CREATOR-- May be specified to instruct virtualenv which--creator=to use.PIPENV_VIRTUALENV_COPIES-- When specified as truthy, instructs virtualenv to not use symlinks. #5477pathis not propagated to thePipfile.lock. #5479update --outdatedraises NonExistentKey with outdated dev packages #5540Vendored Libraries
pip==22.3.1which is currently the latest version ofpip. #5520v2022.11.30Compare Source
Bug Fixes
v2022.11.25Compare Source
Bug Fixes
pipenv checkcommand has been broken in the published wheel distribution. #5493v2022.11.24Compare Source
Bug Fixes
v2022.11.23Compare Source
Features & Improvements
Vendored Libraries
Drop yaspin which is no longer used.
Bump vistir to version 0.7.4
Remove parse.
Remove termcolor.
Remove idna. #5481
v2022.11.11Compare Source
Bug Fixes
v2022.11.5Compare Source
Bug Fixes
coloramadue to regressions in core functionality. #5459v2022.11.4Compare Source
Features & Improvements
Bug Fixes
install_search_all_sourcesisfalse(default behavior).This fixes regression where install phase was using unexpected index after updating
pip==22.3#5444Vendored Libraries
Bump attrs version see #5449.
Drop distlib, colorama and platformdirs - use the ones from pip._vendor. #5450
v2022.10.25Compare Source
Features & Improvements
Vendored Libraries
Removals and Deprecations
v2022.10.12Compare Source
Improved Documentation
v2022.10.11Compare Source
Bug Fixes
v2022.10.10Compare Source
Features & Improvements
<pathed.module>:<func>and can also take arguments. For example:func = {call = "package.module:func('arg1', 'arg2')"}then this can be activated in the shell withpipenv run func#5294Bug Fixes
2022.10.9wherePipfilewithpipenvsection began generating new hash,and also fix regression where lock phase did not update the hash value. #5394
v2022.10.9Compare Source
Behavior Changes
Relates to dev process changes
pipenv run pytest --markersv2022.10.4Compare Source
Bug Fixes
--creator=venvwhen creating virtual environments to avoid issue with sysconfigposix_prefixon some systems. #5075Vendored Libraries
v2022.9.24Compare Source
Bug Fixes
requirementslib==2.0.3to always evaluate the requirement markers fresh (without lru_cache) to fix marker determinism issue. #4660v2022.9.21Compare Source
Bug Fixes
install --skip-lockwith update toplette. #5368v2022.9.20Compare Source
Behavior Changes
Remove usage of pipfile module in favour of Plette.
pipfile is not actively maintained anymore. Plette is actively maintained,
and has stricter checking of the Pipefile and Pipefile.lock. As a result,
Pipefile with unnamed package indices will fail to lock. If a Pipefile
was hand crafeted, and the source is anonymous an error will be thrown.
The solution is simple, add a name to your index, e.g, replace:
With:
Bug Fixes
pipenvpath patch withimportlib.utilto eliminate import ofpkg_resources#5349Vendored Libraries
v2022.9.8Compare Source
Features & Improvements
pipinstall by supplying--extra-pip-args="<arg1> <arg2>"See the updated documentation
Supplying additional arguments to pipfor more details. #5283Bug Fixes
PIPENV_CUSTOM_VENV_NAMEis more useful across projects. #5334Vendored Libraries
Removals and Deprecations
Relates to dev process changes
pypiserveras a standalone process for all tests that referencce internalpypiartifacts.General refactoring of some test cases to create more variety in packages selected--preferring lighter weight packages--in existing test cases.
v2022.9.4Compare Source
Bug Fixes
2022.9.2where tarball URL packages were being skipped on batch_install. #5306v2022.9.2Compare Source
Bug Fixes
requirementslib==2.0.3to always evaluate the requirement markers fresh (without lru_cache) to fix marker determinism issue. #4660v2022.8.31Compare Source
Features & Improvements
batch_installresults in a faster and less CPU intensivepipenv syncorpipenv installexperience. #5301Bug Fixes
pipenvnow uses aNamedTemporaryFilefor rsolver constraints and drops internal env varPIPENV_PACKAGES. #4925Removals and Deprecations
which_pip. #5314batch_installrequirements in at most two invocations ofpip install.To see progress of install pass
--verboseflag andpipprogress will be output in realtime. #5315v2022.8.30Compare Source
Bug Fixes
pipenv install --systemon systems that having thepythonexecutable pointing to Python 2 and a Python 3 executable beingpython3. #5296constraintsbefore resolving, which fixespipenv lockgenerates nondeterminism environment markers. #5299Vendored Libraries
requirementslib==2.0.1which fixes issue with local install not marked editable, and vendor invistir==0.6.1which drops python2 support.Drops
orderedmultidictfrom vendoring. #5308v2022.8.24Compare Source
Bug Fixes
setuptoolsandpkg_resourcesto avoid conflict upgradingsetuptools.Roll back
sysconfigpatch ofpipbecause it was problematic for some--systemcommands. #5228Vendored Libraries
requirementslib==2.0.0and droppip-shimsentirely. #5228pythonfinder==1.3.1#5292v2022.8.19Compare Source
Bug Fixes
install_requiresconstraints fromsetup.pythat depend on editable dependencies and could not resolve them. #5271pipenv lockfails for packages with extras as of2022.8.13. #5274BAD_PACKAGESfrombatch_installin order forpipenvto install specific versions ofsetuptools.To prevent issue upgrading
setuptoolsthis patches_USE_SYSCONFIG_DEFAULTto usesysconfigfor3.7and above whereaspipdefault behavior was3.10and above. #5275v2022.8.17Compare Source
Bug Fixes
pipenv install --systemwith a python3 but no python. #5261pipenvfrom site-packages and removed--ignore-installedargument from pip install in order to fix regressions with--use-site-packages. #5265v2022.8.15Compare Source
Bug Fixes
pip_installmethod was using a different way of finding the python executable than otherpipenvcommands, which caused an issue with skipping package installation if it was already installed in site-packages. #5254v2022.8.14Compare Source
Bug Fixes
packaginglibrary fromBAD_PACKAGESconstant to allow it to be installed, which fixes regression frompipenv==2022.8.13. #5247v2022.8.13Compare Source
Bug Fixes
CIorTF_BUILDis set but does not evaluate toFalseit is now treated asTrue. #5128pipenvcommands that were still referencing the user or system installedpipto use the vendoredpipinternal topipenv. #5229packagesas constraints when lockingdev-packagesin Pipfile.Use
packagesas constraints when installing newdev-packages. #5234Vendored Libraries
pipupdate22.2.2#5230Improved Documentation
Removals and Deprecations
install -rorlock -rhas been removed in favor of thepipenv requirementscommand. #5200v2022.8.5Compare Source
Features & Improvements
Bug Fixes
pip_shimsfrom the non vendoredpipenvcode, but retain initialization forrequirementslibstill has usages. #5204redin exception when getting hashes from pypi in_get_hashes_from_pypi. #5206subprocess_rundirectly tostdoutinstead of creating temporary file.Remove deprecated
distutils.sysconfig, usesysconfig. #5210Vendored Libraries
notpiptopipin order to be clear that its a patched version of pip.pip, even for all types of installs.pip==22.2pipdeptreeto not usepip-shims#5188urllib3in favor of using it from vendored version inpip._vendor#5215Removals and Deprecations
v2022.7.24Compare Source
Bug Fixes
NO_COLORenvironment variable and deprecatePIPENV_COLORBLINDvariable, which will be removed after this release. #5158no_depsfor all other requirements in the loop causing a retry condition. #5164requirementslibfor fix to lock when using editable VCS module with specific@git reference. #5179Vendored Libraries
pip==22.1.2which upgradespipenvfrompip==22.0.4.Vendor in latest version of
requirementslib==1.6.7which includes a fix for tracebacks on encountering Annotated variables.Vendor in latest version of
pip-shims==0.7.3such that imports could be rewritten to utilizepackagingfrom vendor'dpip.Drop the
packagingrequirement from thevendordirectory inpipenv. #5147normailze-charset. #5161funcsigs. #5168pyparsing==3.0.9. #5170v2022.7.4Compare Source
Behavior Changes
pipenv requirementsto add markers and add an--exclude-markersoption to allow the exclusion of markers. #5092Bug Fixes
pipenv requirements#5134Vendored Libraries
requestsandcertififrom vendoredpipand remove them as explicit vendor dependencies. #5000requirementslib==1.6.5which includes bug fixes for beta python versions, projects with an at sign (@) in the path, and asetuptoolsdeprecation warning. #5132Relates to dev process changes
v2022.6.7Compare Source
What's Changed
venvinstall scheme if it is detected by @torsava in https://github.com/pypa/pipenv/pull/5096Full Changelog: pypa/pipenv@v2022.5.2...v2022.6.7
v2022.5.2Compare Source
Bug Fixes
pipenv lock -rcommand printing to stdout instead of stderr. #5091v2022.4.30Compare Source
Bug Fixes
requirementscommand problem by modifying to print-eand path of the editable package. #5070setuptoolsrequirement insetup.pyback to what it was in order to fixFileNotFoundError: [Errno 2]issue report. #5075Vendored Libraries
requirementslib==1.6.4to FixSetuptoolsDeprecationWarningsetuptools.config.read_configurationbecame deprecated. #5081Removals and Deprecations
v2022.4.21Compare Source
Removals and Deprecations
pipenvpackages' Metadata. #5065v2022.4.20Compare Source
Features & Improvements
install_search_all_sourcesthat allows installation of packages from anexisting
Pipfile.lockto search all defined indexes for the constrained package version and hash signatures. #5041Bug Fixes
no_inputflag, so the use of e.g Google Artifact Registry is possible. #4706Vendored Libraries
pipfrom21.2.2to22.0.4which fixes a number of bugs includingseveral reports of pipenv locking for an infinite amount of time when using certain package constraints.
This also drops support for python 3.6 as it is EOL and support was removed in pip 22.x #4995
Removals and Deprecations
more-itertoolsas it was originally added forzipp, which since stopped using it. #5044pipenv.vendor.vistir.compat.fs_str, since this function was used for PY2-PY3 compatibility and is no longer needed. #5062Relates to dev process changes
v2022.4.8Compare Source
Features & Improvements
pipenv requirementscommand which generates a requirements.txt compatible output without locking. #4959Bug Fixes
.venvin the project whenPIPENV_VENV_IN_PROJECTvariable is False.Unset variable maintains the existing behavior of preferring to use the project's
.venvshould it exist. #2763be missing from the
Pipfile.lockfollowing package index restrictions added inpipenv==2022.3.23. #5023Improved Documentation
clickwas vendored into the project in2021.11.9because by defaultsphinx-clickcould no longer determine the CLI inherited from click. #4778Removals and Deprecations
installargument--extra-index-urlas it was not compatible with index restricted packages.Using the
--indexargument is the correct way to specify a package should be pulled from the non-default index. #5022Relates to dev process changes
Very similar to pip's configuration; adds a towncrier new's type
processfor change to Development processes.v2022.3.28Compare Source
Bug Fixes
--quietflag was set #5010requirementslibwas not fully specifying the subdirectory tobuild_pep517andand when a new version of
setuptoolswas released, the testtest_lock_nested_vcs_direct_urlbroke indicating the Pipfile.lock no longer contained the extra dependencies that should have been resolved.
This regression affected
pipenv>=2021.11.9but has been fixed by a patch torequirementslib. #5019Vendored Libraries
v2022.3.24Compare Source
Features & Improvements
Loading .env environment variablesmessage onpipenv runwith the
--quietflag or thePIPENV_QUIETenvironment variable. #4027Bug Fixes
caused and error to be thrown during install. #5002
Loading .env environment variables...has been switched back to stderr as to notbreak requirements.txt generation. Also it only prints now when a
.envfile is actually present. #5003v2022.3.23Compare Source
Features & Improvements
PIPENV_SKIP_LOCKto control the behaviour of lock skipping. #4797verify, checks the Pipfile.lock is up-to-date #4893Behavior Changes
Bug Fixes
PIP_TARGETis set to environment variables, Refer specified directory for calculate delta, instead default directory #4775CIenvironment value, over mere existence of name #4944Vendored Libraries
pythonfinderfrom1.2.9to1.2.10which fixes a bug with WSL(Windows Subsystem for Linux) when a path can not be read and Permission Denied error is encountered. #4976
Removals and Deprecations
--codefrominstalland--unusedfromcheck.Check command no longer takes in arguments to ignore.
Removed the vendored dependencies:
pipreqsandyarg#4998psf/requests (requests)
v2.32.3Compare Source
Bugfixes
HTTPAdapter. (#6716)
without the
sslmodule. (#6724)v2.32.2Compare Source
Deprecations
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed
_get_connectiontoa new public API,
get_connection_with_tls_context. Existing customHTTPAdapters will need to migrate their code to use this new API.
get_connectionis considered deprecated in all versions of Requests>=2.32.0.A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1Compare Source
Bugfixes
v2.32.0Compare Source
Security
verify=Falseon the first request from aSession will cause subsequent requests to the same origin to also ignore
cert verification, regardless of the value of
verify.(GHSA-9wx4-h78v-vm56)
Improvements
verify=Truenow reuses a global SSLContext which should improverequest time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
(
chardetorcharset_normalizer) when repackaged or vendored.This enables
pipand other projects to minimize their vendoringsurface area. The
Response.text()andapparent_encodingAPIswill default to
utf-8if neither library is present. (#6702)Bugfixes
calculated in the request content-length. (#6589)
/(path separator) could leadurllib3 to unnecessarily reparse the request URI. (#6644)
Deprecations
Documentation
Packaging
The source files for the projects (formerly
requests) is now locatedin
src/requestsin the Requests sdist. (#6506)using
hatchling. This should not impact the average user, but extremely oldversions of packaging utilities may have issues with the new packaging format.
v2.31.0Compare Source
Security
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of
Proxy-Authorizationheaders to destination servers whenfollowing HTTPS redirects.
When proxies are defined with user info (
https://user:pass@proxy:8080), Requestswill construct a
Proxy-Authorizationheader that is attached to the request toauthenticate with the proxy.
In cases where Requests receives a redirect response, it previously reattached
the
Proxy-Authorizationheader incorrectly, resulting in the value beingsent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.
Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.
Full details can be read in our Github Security Advisory
and CVE-2023-32681.
v2.30.0Compare Source
Dependencies
This may contain minor breaking changes so we advise careful testing and
reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html
prior to upgrading.
Users who wish to stay on urllib3 1.x can pin to
urllib3<2.v2.29.0Compare Source
Improvements
standardization. (#6226)
v2.28.2Compare Source
Dependencies
Bugfixes
v2.28.1Compare Source
Improvements
iter_contentwith transition toyield from. (#6170)Dependencies
v2.28.0Compare Source
Deprecations
Improvements
an encoding to make
json()API consistent. (#6097)all invalid cases. (#6154)
Bugfixes
CURL_CA_BUNDLEto an empty string would disablecert verification. All Requests 2.x versions before 2.28.0 are affected. (#6074)
urllib3.exceptions.SSLErrorwithrequests.exceptions.SSLErrorforcontentanditer_content. (#6057)to raise an exception rather than ignoring the entry. (#6149)
JSONDecodeError. (#6036)
Configuration
📅 Schedule: Branch creation - "after 5pm on the first day of the month" in timezone Europe/Zurich, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.